CVE

Id
43778  
CVE No.
CVE-2010-1194  
Status
Candidate  
Description
The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.  
Phase
Assigned (20100330)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
476776 43778 CVE-2010-1194 MLIST:[oss-security] 20100303 CVE Request: libesmtp does not check NULL bytes in commonName  View
476777 43778 CVE-2010-1194 URL:http://www.openwall.com/lists/oss-security/2010/03/03/6  View
476778 43778 CVE-2010-1194 MLIST:[oss-security] 20100309 Re: CVE Request: libesmtp does not check NULL bytes in commonName  View
476779 43778 CVE-2010-1194 URL:http://www.openwall.com/lists/oss-security/2010/03/09/3  View
476780 43778 CVE-2010-1194 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191  View
476781 43778 CVE-2010-1194 SUSE:SUSE-SR:2010:011  View
476782 43778 CVE-2010-1194 URL:http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html  View
476783 43778 CVE-2010-1194 VUPEN:ADV-2010-1107  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
35913 JVNDB-2010-001693 複数の Mozilla 製品における任意のコードを実行される脆弱性 複数の Mozilla 製品には、プラグインのインスタンスの処理に関して不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2010-1198 43778 9.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001693.html  View